Title: CryptoPHP Vulnerability? Last modified: August 22, 2016 --- # CryptoPHP Vulnerability? * Resolved [rvbinder](https://wordpress.org/support/users/rvbinder/) * (@rvbinder) * [11 years, 9 months ago](https://wordpress.org/support/topic/cryptophp-vulnerability/) * Will WordFence detect and/or disable the CryptoPHP Trojan? * [http://www.pcworld.com/article/2853192/over-23000-web-servers-infected-with-cryptophp-backdoor.html](http://www.pcworld.com/article/2853192/over-23000-web-servers-infected-with-cryptophp-backdoor.html) * [https://wordpress.org/plugins/wordfence/](https://wordpress.org/plugins/wordfence/) Viewing 8 replies - 1 through 8 (of 8 total) * [WFSupport](https://wordpress.org/support/users/wfsupport/) * (@wfsupport) * [11 years, 9 months ago](https://wordpress.org/support/topic/cryptophp-vulnerability/#post-5541179) * Hi * Great question! We actually interface with the guys at Fox-IT and they sent it to us when they published it. Our boss summarized it the next day or so on our blog, here: [http://www.wordfence.com/blog/2014/11/wordpress-security-nulled-scripts-cryptophp-infection/](http://www.wordfence.com/blog/2014/11/wordpress-security-nulled-scripts-cryptophp-infection/) * The crux of it is that we have an included option to scan image files as executable which should address this problem. It’s something I run on my own sites just to make sure, having been the victim of it a few years before I started using Wordfence. * So the short answer is yes, if you enable the option. I also highly recommend disabling php execution in your uploads folders. * Does that answer your question? * tim * Thread Starter [rvbinder](https://wordpress.org/support/users/rvbinder/) * (@rvbinder) * [11 years, 9 months ago](https://wordpress.org/support/topic/cryptophp-vulnerability/#post-5541287) * Yes. In case others want to do this, go to WordFence.options.Scans to include, then check “Scan image files as if they were executable”. * Thanks * Thread Starter [rvbinder](https://wordpress.org/support/users/rvbinder/) * (@rvbinder) * [11 years, 8 months ago](https://wordpress.org/support/topic/cryptophp-vulnerability/#post-5541412) * My ISP claims that I have exceeded my CPU seconds quota this month. Google Analytics shows that the total page views for the month is very near the average of the year and well under the max of several months ago (which did not exceed that quota.) Besides upgrades to the newest WP version and plugins, the only substantive change I made to my site this month was to set the above scan option. Does the scan result in much high CPU utilization? * [WFBrian](https://wordpress.org/support/users/wfbrian/) * (@wfbrian) * [11 years, 8 months ago](https://wordpress.org/support/topic/cryptophp-vulnerability/#post-5541413) * Check your cron jobs. There may be multiple scans set to run. You should be able to delete unnecessary scans in cron. Please see the following post and see if it addresses your issue… * [https://wordpress.org/support/topic/excessive-resources-on-many-hosting-accounts-with-wordfence](https://wordpress.org/support/topic/excessive-resources-on-many-hosting-accounts-with-wordfence) * Thread Starter [rvbinder](https://wordpress.org/support/users/rvbinder/) * (@rvbinder) * [11 years, 8 months ago](https://wordpress.org/support/topic/cryptophp-vulnerability/#post-5541415) * I monitored cron, etc. Not the cause. * I unchecked the WordFence scan images option. This resulted in a dramatic drop in CPU utilization shown in the graph. * [ Here’s the actual CPU utilization graph. * Looks like some performance tuning of WordFence is called for. * [WFSupport](https://wordpress.org/support/users/wfsupport/) * (@wfsupport) * [11 years, 8 months ago](https://wordpress.org/support/topic/cryptophp-vulnerability/#post-5541416) * Actually it has a lot t0o do with how many images your site has. That’s a lot for the scanner to do. One thing that I think helps is detailed here: [http://docs.wordfence.com/en/Wordfence_options#Maximum_execution_time_for_each_scan_stage](http://docs.wordfence.com/en/Wordfence_options#Maximum_execution_time_for_each_scan_stage) * It helped on my sites, at least. * tim * Thread Starter [rvbinder](https://wordpress.org/support/users/rvbinder/) * (@rvbinder) * [11 years, 8 months ago](https://wordpress.org/support/topic/cryptophp-vulnerability/#post-5541417) * If a file hasn’t changed since the last time it was scanned it seems to me you don’t need to scan it again, unless you suspect the file date/time can be corrupted. So, scanning an unchanged file is needless. You don’t even need to maintain a list. Scan everything when the scan is first enabled, save that timestamp, then only rescan files that change after that. * [WFSupport](https://wordpress.org/support/users/wfsupport/) * (@wfsupport) * [11 years, 8 months ago](https://wordpress.org/support/topic/cryptophp-vulnerability/#post-5541418) * Time and dates can be manipulated as can other attributes. We err on the side of being paranoid so we don’t miss something. I do understand your point, though and we’ll take this under consideration for a possible future release. * tim Viewing 8 replies - 1 through 8 (of 8 total) The topic ‘CryptoPHP Vulnerability?’ is closed to new replies. * ![](https://ps.w.org/wordfence/assets/icon.svg?rev=2070865) * [Wordfence Security - Firewall, Malware Scan, and Login Security](https://wordpress.org/plugins/wordfence/) * [Frequently Asked Questions](https://wordpress.org/plugins/wordfence/#faq) * [Support Threads](https://wordpress.org/support/plugin/wordfence/) * [Active Topics](https://wordpress.org/support/plugin/wordfence/active/) * [Unresolved Topics](https://wordpress.org/support/plugin/wordfence/unresolved/) * [Reviews](https://wordpress.org/support/plugin/wordfence/reviews/) ## Tags * [trojan](https://wordpress.org/support/topic-tag/trojan/) * 8 replies * 3 participants * Last reply from: [WFSupport](https://wordpress.org/support/users/wfsupport/) * Last activity: [11 years, 8 months ago](https://wordpress.org/support/topic/cryptophp-vulnerability/#post-5541418) * Status: resolved